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                                                                      OIG-AR-14-04


To:          David Sena, Senior Vice President and Chief Financial Officer
             Fernanda Young, Chief Information Officer

From:		      Arturo Cornejo AC
             Assistant Inspector General for Audits (Acting)

Subject:		   Fiscal Year 2013 Financial Statement Audit - Final Management Letter
             OIG-AR-14-04

Date:		      March 21, 2014


This memorandum transmits Deloitte and Touche LLP’s Management Letter of the
Export-Import Bank of the United States (Ex-Im Bank) financial statements for fiscal
year ended 2013. Under a contract monitored by this office, we engaged the
independent public accounting firm of Deloitte and Touche to perform the audit.
The contract required the audit to be done in accordance with: United States
generally accepted government auditing standards; Office of Management and
Budget audit guidance; and the Government Accountability Office/President’s
Council on Integrity and Efficiency Financial Audit Manual.

Deloitte and Touche identified deficiencies related to the Ex-Im Bank’s internal
control over financial reporting and other matters that needed your attention. The
observations, recommendations, and your responses regarding such matters are
presented in the Attachment.

Deloitte and Touche is responsible for the attached management letter dated March
19, 2014 and the conclusions expressed in the letter. We do not express opinions on
Ex-Im Bank’s financial statements or internal control or conclusions on compliance
with laws and regulations.

We appreciate the cooperation and courtesies provided to Deloitte and Touche and
this office during the audit. If you have questions, please contact Julie Wong,
(202) 565-3920 Julie.Wong@exim.gov, or me at (202) 565-3499
Arturo.Cornejo@exim.gov. You can obtain additional information about the Export-
Import Bank Office of Inspector General and the Inspector General Act of 1978 at
www.exim.gov/oig.
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cc:   Fred Hochberg, Chairman and President
      C.J. Hall, Executive Vice President and Chief Risk Officer
      Michael Cushing, Senior Vice President and Chief Operating Officer
      Audit Committee
      Nathalie Herman, Treasurer, Office of the Chief Financial Officer
      Patricia Wolf, Controller, Office of the Chief Financial Office
      John Lowry, Director, Information Technology Security and Systems
              Assurance


      Inci Tonguch-Murray, Business Compliance Officer


      Duncan Barks, Partner, Deloitte and Touche LLP






                 811 Vermont Avenue, NW Washington, D.C. 20571
Deloitte.                                                                                Deloitte & Touche LLP
                                                                                         1750 Tysons Blvd.
                                                                                         Mclean, VA 22 102-4219
                                                                                          USA
                                                                                         Tel:+1 703 251 1000
                                                                                         Fax: + 1 703 251 3400
                                                                                         www.deloitte.com
March 19, 2014


Management of the Exp01i-Imp01i Bank of the United States
811 V ennont A venue NW
Washington, D.C. 20571

Dear Members of Management:

In planning and performing our audit of the financial statements of the Export-Imp01i Bank of the United
States ("Ex-Im Bank") as of and forthe year ended September 30, 2013 (on which we have issued our
rep01i dated December 12, 2013), in accordance with auditing standards generally accepted in the United
States of America, the standards applicable to the financial audits contained in the Government Auditing
Standards, issued by the Comptroller General of the United States, and Office of Management and the
Budget Bulletin No. 14-02, Audit Requirements for Federal Financial Statements, as amended, we
considered the Ex-Im Bank's internal control over financial reporting as a basis for designing audit
procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on
the effectiveness of the Ex-Im Bank's internal control over financial reporting. Accordingly, we do not
express an opinion on the effectiveness of the Ex-Im Bank's internal control over financial reporting. This
report is based on our knowledge as of the date of our report on the financial statements, obtained in
perfonning our audit thereof, and should be read with that understanding.

Our consideration of internal control over financial reporting was for the limited purpose described in the
preceding paragraph and was not designed to identify all deficiencies in internal control over financial
reporting. However, in connection with our audit, we identified, and included in the attached Appendix A,
deficiencies related to the Ex-Im Bank's internal control over financial reporting and other matters as of
September 30, 2013, that we wish to bring to your attention.
Based on our audit work, we believe management adequately addressed the deficiencies reported in our
fiscal year (FY) 2012 management letter (see AppendixB).
The definition of a deficiency is also set forth in the attached Appendix A.
Although we have included management's written response to our comments in Section I, such responses
have not been subjected to the auditing procedures applied in our audit of the financial statements and,
accordingly, we do not express an opinion or provide any form of assurance on the appropriateness of the
responses or the effectiveness of any corrective actions described therein.
This report is intended solely for the information and use of management, the Audit Committee, the
Inspector General, and others within the organization and is not intended to be, and should not be, used by
anyone other than these specified parties.
Yours truly,




cc: The Inspector General of the Export-Imp01i Bank of the United States and the Audit Committee of the
    Expo ti-Import Bank of the United States



                                                                                         Member of
                                                                                         Deloitte Touche Tohmatsu Limited
                                                                                               APPENDIX A 


SECTION I -      DEFICIENCIES

We identified, and have included below, deficiencies involving the Ex-Im Bank's internal control over
financial repo11ing for the period from October 1, 2012 through September 30, 2013 that we wish to bring
to your attention.

Incorrect Maturity Dates of Working Capital Guarantee Transactions

Condition:

Ex-Im Bank identified that maturity dates for some of the working capital guarantee transactions
authorized during FY 2012 and 2013 were inaccurate. We identified 122 working capital guarantee
transactions authorized during FY 2012 as inaccurate. For FY 2013 transactions, management made
conections prior to audit testing. We found no exceptions for FY 2013 transactions after corrections made
by management.

Criteria:

The maturity dates of working capital guarantee transactions should be correctly reflected on the Ex-Im
Bank' s portfolio. Additionally, sufficient controls should be in place to timely detect errors identified in
the entry of such information.

Cause:

Due to inappropriate supervision and review, a staff member had been entering the maturity dates for new
working capital guarantees into the Loans and Guarantees Accounting System (LGA) incorrectly. The
staff entered the maturity date based on six months after the authorization date instead of six months after
the final disbursement date or expiration date.

Effect or Potential Effect:

The incorrect working capital guarantee maturity dates resulted in exclusions of some working capital
guarantees from Ex-Im Bank's 2012 potifolio. This resulted in an understatement of 2012 working capital
guarantees exposure and the allowance for working capital guarantees of approximately $495 million
(0.5% of the FY 2012 total portfolio exposure) and $2.9 million (0.2% of FY 2012 loan guarantee
liability), respectively. Ex-Im Bank did not correct the 2012 financial statements as they were considered
to be immaterial by Ex-Im Bank. We concurred with Ex-Im Bank's conclusion not to correct 2012
exposure. The maturity dates for transactions authorized during FY 2013 were corrected as of
September 30, 2013 .

Recommendation:

We recommend Ex-Im Bank enhances the review process of the working capital guarantee information
entered by staff members. Additionally, management should communicate accounting policy and
procedures regarding working capital transactions to staff members. Specifically, by creating a desk
procedure that would effectively communicate policy and procedures to new staff members.
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Management Response:

Management agrees with the recommendation. Additional training on accounting policies and bank
procedures has been provided to staff members by depaiiment supervisors, before and after the error
occmTed. Management will maintain a focus of improving efficiency in the review process and in the
standard operating procedure to ensure consistency and accuracy. Management will continue to
communicate and update staff on any changes in the accounting policy and procedures should they
change in the future.

Incorrect Late Interest Calculation

Condition:

We identified that the late interest was incorrectly calculated due to inaccurate invoice received dates,
lack of time stamp on invoices received, and inconsistencies in selecting appropriate invoice received
dates in the event that a proper time stamp was missing.

Criteria:

The late interest for vendor invoices should be calculated as instructed by the Prompt Payments Act (5
CFR Part 1315), which states that interest will accrue from the day after the payment due date, until the
payment date. The payment due date is deemed the later of the date the invoice is received and stamped,
or seven days after the goods are received or services delivered.

Cause:

There was a lack of policy in place to provide proper guidance on appropriate invoice dates for the
purpose of late interest calculation according to the Prompt Payment Act.

Effect or Potential Effect:

Interest expenses related to late payment could have been understated by approximately $12,000 as of
September 30, 2013. Ex-Im Bank implemented a plan to ensure proper time stamp and consistent invoice
received dates as of September 30, 2013.

Recommendation:

We recommend that Ex-Im Bank institutes specific policies for the application of proper invoice date
according to the Prompt Payment Act to ensure adherence to these policies. Ex-Im Bank should
implement proper controls to ensure the correct invoice dates are entered.

Management Response:

Management agrees with the recommendation. Management has installed two new stamping machines to
counter equipment failure and has implemented a new process that requires staff to date-stamp the
invoices that are processed. This will ensure that invoices have the proper date in accordance with the
Prompt Payment Act. In addition, the Office of Contracting (OCS) and the Office of Administrative
Services (OAS) supplied additional training to staff members on the importance of date-stamping
incoming invoices in accordance with the Prompt Payment Act.
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Inaccurate Subsidy Re-estimate Journal Entries

Condition:

During our testing of the subsidy re-estimate journal entry, the following errors were noted :

1) 	 Ex-Im Bank identified that the FY 2013 subsidy re-estimate journal entry was incotTectly recorded .
     The guarantee provision was incorrectly recorded as insurance provision.

2) 	 We identified that the subsidies for guarantee and insurance transactions were correctly calculated.
     However, the subsidies for the coho1t year 2012 for insurance and guarantee transactions were not
     included in the subsidy re-estimate journal entry and therefore were not recorded.

Ex-Im Bank recorded correcting journal entries to correct the errors as of September 30, 2013.

Criteria:

The subsidy re-estimate journal entry should be recorded correctly according to accurate information and
calculations according to the Expected Loss Model developed by Ex-Im Bank.

Cause:

The subsidy re-estimate spreadsheet used to calculate the total subsidies had an incorrect formula which
was not detected upon review. Additionally, the subsidy for guarantees was inconectly recorded as
subsidy for insurance due to human error.

Effect or Potential Effect:

The downward and upward subsidies were understated by approximately $80 and $10 million,
respectively at September 30, 2013. Ineffective review of the journal entries prior to posting could
potentially cause an incorrect subsidy re-estimate journal entty and therefore an inaccurate subsidy
recorded in the financial statements. The errors were corrected by Exlm Bank as of September 3 0, 2013.

Recommendation:

We recommend that a more comprehensive review of the subsidy re-estimate spreadsheet, as well as the
journal entty, be performed to detect any material misstatements in a timely manner.

Management Response:

Management agrees with the recommendation. The Office of the Chief Financial Officer is implementing
a comprehensive review of the inputs and outputs of the calculation. Management continues to provide
training to staff on the importance of a detailed review process that is conducted in a timely manner.

Incorrect Interest Rate used in the Calculation of the Subsidy Re-estimate

Condition:

During our testing of the FY 2013 subsidy re-estimate, we identified that incotTect interest rates for
medium term and long tenn guarantees were utilized in the subsidy macro input table.
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Criteria:

The subsidy re-estimate calculation macro should use the correct interest rate in order to calculate the
subsidy accurately.

Cause:

Due to deficient review process, the interest rates for medium term and long term guarantees were
incorrectly entered into the input table by the financial analyst. The incorrect rate were not identified in a
timely manner.

Effect or Potential Effect:

The total provision was misstated by approximately $22 million. Ex-Im Bank made corrections to the
interest rate in the macro input table and recalculated the subsidy for FY 2013. Accordingly, Ex-Im Bank
recorded an adjustment to accurately reflect the provisions at September 30, 2013.

Recommendation:

We recommend that Ex-Im Bank perfonn a more comprehensive review of the inputs used in the macro
prior to performing the calculation of the subsidy re-estimate.

Management Response:

Management agrees with the recommendation. The Office of the Chief Financial Officer is implementing
a comprehensive review ofthe inputs and outputs of the calculation. Management continues to provide
training to staff on the importance of a detailed review process that is conducted in a timely manner.

Inaccurate Rescheduled Loans Balance

Condition:

We identified a rescheduled loan which was recorded inaccurately in the LGA. The rescheduled loan
identified by us maintained an outstanding balance of approximately $983,000 when it should be written
off by Ex-Im Bank.

Criteria:

Only rescheduled loans for which future cash flows are expected should be included in the records of Ex­
Im Bank.

Cause:

Due to insufficient review, a journal entry to write-off a rescheduled loan was recorded inaccurately.

Effect or Potential Effect:

The rescheduled loan balance was overstated by approximately $983,000. This error was determined
immaterial by Ex-Im Bank and no correction was made. We concurred with Ex-Im Bank's conclusion.
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Recommendation:

We recommend that controls be implemented to ensure that the proper journal entry is recorded to write
off the rescheduled loan.

Management Response:

Management agrees with the recommendation. In an effo11 to ensure accuracy in the write off process,
Management will implement a control of cross checking the Rescheduled Loan (R-Loan) rep011 on a
periodic basis against known qualitative data and c01Tesponding information. Management will continue
to monitor the report and provide additional training if needed.

Inappropriate Evidence or Inappropriate Assignment of Transactions for Risk Rating

Condition:

During our testing of risk rating, we identified inaccurate assignment of transactions within the Portfolio
Monitoring and Control Group's (PMCG) non-core transactions and sh011-tenn single buyer insurance
transactions.

Criteria:

BCL ratings should be re-evaluated annually according to the FY 2013 Restimate Process. BCL ratings
should accurately reflect the underlying risk of a transaction/bon-ower.

Cause:

Due to miscommunication among monitoring division, the following were noted:

1) 	 Five short-term single buyer insurance were evaluated as private instead of non-sovereign
     transactions.

2) 	 Due to miscommunication, one medium term guarantee was not assigned to an appropriate
     monitoring division. Therefore, the BCL for the bon-ower was not properly evaluated.

Effect or Potential Effect:

Allocating an inaccurate BCL rating to a bon-ower could result in a misstatement in the subsidy re­
estimate.Ex-Im Bank reviewed the transactions identified by D&T and concluded that the BCL rating
was appropriate despite the incon-ect allocation.

Recommendation:

We recommend as a part of the annual risk rating process Ex-Im Bank perform a review of transactions in
the portfolio to ensure that they are assigned to appropriate monitoring divisions.

Management Response:

Management agrees with the recommendation. Management is conducting a comprehensive review of
work-flow between the various divisions to ensure that credits are assigned to the appropriate monitoring
divisions. Every transaction or credit is unique and may not fit into a standardize<) mold, but management
will continue to work to improve the process in place.
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User Access Rights Review

Condition:

We inspected the documentation for the January 2013 annual access rights review and noted that one
(1) user requested to be removed from access by management maintained access to EXIM Online as of
August 1, 2013. The one user noted was from a sample of five selections selected for our testing.

Criteria:

Management's requests for access changes related to the annual access reviews at Ex-Im should be
addressed in a timely manner, and in the specific event access removals are requested, they should be
revoked as soon as possible.

Cause:

Due to a human en-or, and insufficient review, the individual responsible for making access change did
not remove a user's access after his review of the change request.

Effect or Potential Effect:

If access privileges are not established effectively, data integrity, confidentiality, and availability may be
compromised through intentional or unintentional errors. Without effective and timely reviews, there will
be no assurance that user access privileges remain appropriate, or that logical security is effective.
Additionally, potential threats and misuse may not be timely noted. After this exception was identified,
management reviewed and removed the user's access (within EXIM Online) as evidenced through testing
on September 5, 2013 and September 19, 2013.

Recommendation:

While Ex-Im Bank remediated the user access exception, we recommend that Ex-Im Bank continue to
focus on the execution of access changes in relation to the annual access review and perform a
confinnation process after the annual access review to ensure that all required changes were completed
according to the access request. This control assists in the overall effectiveness of Ex-Im Bank's process
for user account administration.

Management Response:

Management agrees with the recommendation. The confirmation process after the annual Access Control
Review (ACR) has been completed and is being executed during the ongoing ACR cycle for FY14 (now
underway since November 2013). Management has determined that there is nothing intrinsic in the failure
to modify the account identified in the finding that exposed the Bank to any additional security risk that
affects the confidentiality, integrity, and availability of the Bank's critical information. Management will
continue to monitor and provide additional controls if needed.
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SECTION II -     OTHER MATTERS

Refer to Appendix B below for the status of the FY 2012 management letter comments.

SECTION Ill -     DEFINITIONS

The definitions of a deficiency is as follows:

A deficiency in internal control over financial repo1iing exists when the design or operation of a control
does not allow management or employees, in the nonnal course of perfonning their assigned functions, to
prevent, or detect and correct misstatements on a timely basis. A deficiency in design exists when (a) a
control necessary to meet the control objective is missing or (b) an existing control is not properly
designed so that, even if the control operates as designed, the control objective would not be met. A
deficiency in operation exists when (a) a properly designed control does not operate as designed, or
(b) the person performing the control does not possess the necessary authority or competence to perform
the control effectively.

                                                 ******
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                                                                                        APPENDIX B

The table below provides the status of the FY 2012 management letter comments:

Control Deficiencies:


                                                        Elevated to
                                                         Material      Still Relevant   Adequately
No.               Prior Year Comments                   Weakness       and Repeated      Resolved


 1.   Budget Cost Level (BCL) ratings relied on                                             x
      inaccurate information


2.    Inconsistency in BCL rating between Loans                                             x
      and Guarantees Accounting System (LGA) and
      the Asset Management System (AMS)


3.    Inaccurate repayment schedule in the LGA                                              x
      System


4.    Inaccurate information used for subsidy                                               x
      calculation ­ cash flow worksheet


5.    Incorrect Accrual Status of Rescheduled Loans                                         x
      written off in prior years


6.    Incorrect Pre-Credit Reform Allowance for                                             x
      Loan Loss journal entry


7.    Incorrect Formula used in the Allowance                                               x
      calculation


8.    Retention of Daily Security Monitoring report                                         x
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